Cisco
Login
Search
Software Multicloud Defense
Activity Onboard

Alerting and Log Forwarding Alert Destinations / SIEMs ServiceNow Create an Alert Rule

Last updated: Jul 03, 2025

Create an Alert Rule

Before you begin

In order to complete the steps in this guide, you will need:

  • A ServiceNow account with an Incoming Webhook URL.

  • An API Key configured.


 

Procedure

1

In the Security Cloud Control platform menu, choose Products > Multicloud Defense .
2

Navigate to System and Accounts > Service Alerts > Alert Rules.
3

Click Create.
4

Profile Name - Enter unique name for the integration. Example mcd-servicenow-alert-rule.
5

(Optional)Description - Enter a description for the aler trule.
6

Alert Profile - Expand the drop-down menu and select a Microsoft Teams alert profile.

7

Type - Expand the drop-down menu and select one of the following types:

  • System Logs

  • Audit Logs

  • Discovery

If you select Audit Logs, there are no other configurable items. Click Save to finalize the rule.
8

If you select either System Logs or Discovery as your Type, then expand the Sub Type drp-down menu and select one of the following options:

  • Gateway

  • Account

  • Controller
9

Expand the Severitydrop-down menu and select one of the following labels. Note that the options below are dependent on the Type you selected in step 7.

  • Info

  • Warning

  • Medium

  • High

  • Critical
10

Enabled - This option is checked by default to enable and implement this alert immediately after saving. Unceck this box if you do not to immediately apply the rule to your environment.
11

Click Save.
Previous topic ServiceNow Next topic Create an Alert Profile Service